topic Re: ArcGIS Server 'Invalid Token' from application, using REST API in ArcGIS REST APIs and Services Questions

ArcGIS Server 'Invalid Token' from application, using REST API

JackSilburn — Thu, 14 May 2020 00:54:10 GMT

Hello.

I am struggling with an issue relating to ArcGIS Server REST API. I believe we are running v 10.6.

My process is:

Create an 'application' in the ArcGIS Server content.

Copy the 'client_id' and 'client_secret' values from this application.
Call the ArcGIS REST API oauth2/token endpoint
Copy the 'access_token' into the ArcGIS REST API /query endpoint
I am receiving a 'invalid token' error code 498.

I have completed this exact process in my organisation's ArcGIS Online platform, with no issues. So I am very perplexed and frustrated that this isn't working .

My token request:

POST /arcgis/sharing/rest/oauth2/token?client_id=XXX&client_secret=XXX&grant_type=client_credentials HTTP/1.1
Host: <domain>:<port>

My query request:

GET /arcgis/rest/services/Hosted/<feature layer name>/FeatureServer/0/query?where=1=1&token=XXX&f=json&outFields=name,device_type
HTTP/1.1
Host:<domain>:<port>

If I copy a token from my Chrome browser (f12 debug mode/network tab) I am able to make both requests successfully!!

I am 'admin' on our server and I own both the application and the feature layer.

Any help is appreciated.

Cheers

**update I tried running the /registerApp endpoint (using a browser Token)

I get the following:

"error": {
"code": 500,
"message": "Unable to register app.",
"details": [
"'redirect_uris' invalid"

I don't know what the purpose of the redirect_uris attribute is; I have tried <domain>:<port> and urn:ietf:wg:oauth:2.0:oob to no effect.

Re: ArcGIS Server 'Invalid Token' from application, using REST API

VictorTey — Thu, 14 May 2020 06:20:53 GMT

Hi Jack Silburn‌, Can you provide more information on what you are trying to do after you have receive the token? Are you trying to create a web application and provide some sort of authentication mechanism? Have you consider using the ArcGIS JS IdentityManager?

The redirect_uri is a list of valid URI that is allowed for redirecting when user have successfully login

For example if you look at

Access ArcGIS Online items using OAuthentication | ArcGIS API for JavaScript 4.15

and their live example

Access ArcGIS Online items using OAuthentication - 4.15

when you click on sign in, you will see it redirect the user to the login page for AGOL. IN the request you will see the redirect_uri telling AGOL once the user have successfully signed in, redirect the user back to the redirect_uri link.

This link HAS TO BE valid and added in your app registration

Re: ArcGIS Server 'Invalid Token' from application, using REST API

JackSilburn — Fri, 15 May 2020 01:23:35 GMT

Hi Victor

I am trying to enable my program to automatically update a feature layer (hosted on ArcGIS Server).

From my understanding, and past implementation with ArcGIS Online, I should simply need to:

Create an 'app'
Copy its client ID and secret
Use these to receive an 'access token'
Use the 'access token' in all future actions - i.e. update, delete, query etc.

This appears to be the same issue experienced by these users:

The approach to authenticating REST API requests in AGOL vs ArcGIS Server seems to be different - despite referencing the same documentation. At least in my opinion.

I didn't have to bother with 'redirect URIs' at all with my AGOL implementation.

Re: ArcGIS Server 'Invalid Token' from application, using REST API

Anonymous User — Tue, 02 Jun 2020 18:05:20 GMT

Jack,

Did you ever find a solution to this I have a python script that mines my REST endpoint that has been completely stopped because of this error. Any ideas on how to solve this?

-Ben

Re: ArcGIS Server 'Invalid Token' from application, using REST API

BushtelAdmin — Thu, 23 Jul 2020 01:01:54 GMT

G'day Jack

Seems to be a popular question on the form, and not a single answer.

Did you find an answer or does the issue go away with later versions of Enterprise?

We have the issue with 10.6.1

Thanks

Re: ArcGIS Server 'Invalid Token' from application, using REST API

BushtelAdmin — Fri, 24 Jul 2020 04:44:40 GMT

G'day All

And the answer, from our local support, to our specific use case:

After reviewing your case and undertaking some research, unfortunately it appears that this functionality is not available using App Login to access Feature Services via ArcGIS Enterprise. In the documentation you have listed below please see the last sub heading 'Available content and services' which lists what you can access using App Login.

Another related bit of documentation is 'Limitations of App Login' found here - https://developers.arcgis.com/documentation/core-concepts/security-and-authentication/limitations-of-application-authentication/

Your use case has been submitted by other Esri customers as an enhancement to be made to the ArcGIS Enterprise product:

ENH-000117119 - 'Provide an ability to use the token generated using client id and client secret of a web application to access a feature service in ArcGIS Enterprise.'

Mind you, we did set the service to public as a test and it still failed. Keeping the service as public was not an option anyways.

Regards

Re: ArcGIS Server 'Invalid Token' from application, using REST API

JackSilburn — Thu, 06 Aug 2020 01:40:22 GMT

Hi Ben

From memory, I made the Feature Service 'visible to everyone' and edit permission enabled. This removed the requirement to authenticate requests to the server.

I justified this approach because:

This was a prototype/proof of concept for a web app
The service is only shared within my Org

In the future I would definitely need Auth.

Did you have any luck yourself?

Regards

Re: ArcGIS Server 'Invalid Token' from application, using REST API

JackSilburn — Thu, 06 Aug 2020 01:50:52 GMT

Hello

I guess that settles it then - I wonder when/if the enhancement will be pushed through...

As I mentioned to another user above, I ended up making the service public, with edit permissions enabled. It's peculiar that it did not work for you still.

I would either need to figure out another method of authenticating, or move my app to my Org's ArcGIS Online platform, where the auth issue is not present.

P.S. It's a small world - I reckon we live in the same state!

Re: ArcGIS Server 'Invalid Token' from application, using REST API

BushtelAdmin — Thu, 06 Aug 2020 02:21:52 GMT

G'day Jack

Have a look at:

Working with different authentication schemes | ArcGIS for Developers

Specifically Non-Interactive Login Experience.

This was changed with the last release of arcpy

Previously was suggested to add username and password to the Interactive example.

PS or Territory

We are thinking of (re)starting a 'usergroup' and if interested drop us an email.

Regards

Re: ArcGIS Server 'Invalid Token' from application, using REST API

KierenTinning2 — Thu, 22 Sep 2022 20:09:45 GMT

Has anyone managed to solve this? We're running into a similar issue. Standard Portal Auth, nothing sophisticated. It's worked for months with mobile clients connecting and synchronizing and suddenly poof. If we reboot the server everything works for about 2 hours and then falls apart.

This error shows up on all services on the server.

Failed to return the service configuration 'XYZ.MapServer'. Server machine 'https://myserver.domain:7443/arcgis/sharing/rest/search' returned an error. 'Invalid token.'

Re: ArcGIS Server 'Invalid Token' from application, using REST API

MattScachette — Wed, 03 Jul 2024 02:37:46 GMT

I was able to solve this but I was forced to use a different OAuth flow than the client_credentials flow. I too was hoping to pass in a client_id and client_secret and query the FeatureServer programmatically.

Instead, to acquire a token which permitted a query of the feature layer, I had to use the user flow (not happy about this but have tried everything else)

curl --location 'https://www.arcgis.com/sharing/rest/generateToken' \

--header 'Content-Type: application/x-www-form-urlencoded' \

--form 'username="your_personal_username"' \

--form 'password="your_personal_password"' \

--form 'client="referer"' \

--form 'expiration="60"' \

--form 'f="json"' \

--form 'referer="https://localhost"'

With this cURL request, you can translate this into your language or tool of choice.

Wish they would just fix this.